From 5f602105a1badbdd31fa3f3a2bddfd86ff8b9c1c Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Sun, 9 Aug 2026 06:25:35 -0700 Subject: [PATCH 1/2] ci: publish the release docs from the release run Until now `release.yaml` reached `publish-web.yaml` indirectly: it force-pushed the release commit to `web` with the bot's PAT so that push would start `publish-web`. Both hops sit behind a required reviewer, so the docs took two approvals to go out. `release.yaml` now calls `publish-web.yaml` directly and builds from the release tag, which holds the same tree `web` was carrying. `push-web-branch` still moves `web`, since that's the base doc-only fixes backport onto, but with the default token: it needs no environment, and its push starts no second publish. The callee can't request a scope its caller lacks, so both call sites grant the `pages` and `id-token` scopes `actions/deploy-pages` needs. `build-web` saves its cache on tags too, so the next `web` build still starts from the release's. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-web.yaml | 4 +++- .github/workflows/publish-web.yaml | 4 +--- .github/workflows/release.yaml | 16 +++++++++++++--- .github/workflows/tests.yaml | 4 ++++ web/book/src/project/contributing/development.md | 12 +++++++----- 5 files changed, 28 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build-web.yaml b/.github/workflows/build-web.yaml index 9a2495b8263e..44ae0f6d8370 100644 --- a/.github/workflows/build-web.yaml +++ b/.github/workflows/build-web.yaml @@ -46,9 +46,11 @@ jobs: with: prefix-key: ${{ env.version }}-${{ hashFiles('./Cargo.lock') }} shared-key: web + # A release builds on its tag, and a later `web` build starts from + # that cache. save-if: ${{ github.ref == 'refs/heads/web' || github.ref == - 'refs/heads/main' }} + 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }} # Caching `~/.cargo/bin/` breaks the rustup `cargo`/`rustc` symlinks # on the new macos-15 runner image — see # https://github.com/Swatinem/rust-cache/issues/341. diff --git a/.github/workflows/publish-web.yaml b/.github/workflows/publish-web.yaml index 7d173b5b9171..82a494a9e047 100644 --- a/.github/workflows/publish-web.yaml +++ b/.github/workflows/publish-web.yaml @@ -1,11 +1,9 @@ name: publish-web on: - # A release ends by pushing its docs to `web` with the bot's PAT, and a push - # made with a PAT does start workflows, so this covers releases too. push: branches: - web - # Called by pull-request when specifically requested + # Called by `release` on a release, and by `tests` on a `pr-publish-web` label workflow_call: workflow_dispatch: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 27c825d159c3..0c4824d84a86 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -426,15 +426,25 @@ jobs: # nexus_password: ${{ secrets.nexus_password }} # directory: prql-java/java/ + publish-web: + if: github.event_name == 'release' + uses: ./.github/workflows/publish-web.yaml + permissions: + contents: read + pages: write + id-token: write + + # `web` tracks the latest release, so doc-only fixes backport onto it. A push + # with the default token starts no workflow, so `publish-web` is the release's + # only publish. push-web-branch: runs-on: ubuntu-24.04 - environment: release if: github.event_name == 'release' + permissions: + contents: write steps: - name: 📂 Checkout code uses: actions/checkout@v7 - with: - token: ${{ secrets.TEND_BOT_TOKEN }} - run: git push origin HEAD:web --force push-devcontainer: diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index e20cb8771937..4c9c9984e911 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -347,6 +347,10 @@ jobs: publish-web: uses: ./.github/workflows/publish-web.yaml if: contains(github.event.pull_request.labels.*.name, 'pr-publish-web') + permissions: + contents: read + pages: write + id-token: write nightly: needs: rules diff --git a/web/book/src/project/contributing/development.md b/web/book/src/project/contributing/development.md index 72dab4d8462d..cc0d2cf80916 100644 --- a/web/book/src/project/contributing/development.md +++ b/web/book/src/project/contributing/development.md @@ -410,8 +410,8 @@ the confidence to make changes faster, please raise an issue. ## Website -The website is published together with the book and the playground, and is -automatically built and released on any push to the `web` branch. +The website is published together with the book and the playground, from a +release's tag and from any later push to the `web` branch. The `web` branch points to the latest release plus any website-specific fixes. That way, the compiler behavior in the playground matches the latest release @@ -498,9 +498,11 @@ Currently we release in a semi-automated way: )" ``` -4. From there, both the tag and release is created and all packages are - published automatically based on our - [release workflow](https://github.com/PRQL/prql/blob/main/.github/workflows/release.yaml). +4. From there the tag and release are created, and the + [release workflow](https://github.com/PRQL/prql/blob/main/.github/workflows/release.yaml) + publishes the packages and the website. Its publishing jobs sit behind the + `release` and `github-pages` environments, so approve the pending deployments + on the run's page. 5. Run `cargo release patch --no-publish --no-push --execute --no-verify --no-confirm --no-tag && task prqlc:test-all && cargo insta test --accept -p mdbook-prql` From b09fae547bc4b972981747490fc57be9f334ad52 Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Sun, 9 Aug 2026 13:02:24 -0700 Subject: [PATCH 2/2] ci: drop the release-tag cache save MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Caches are scoped by ref: a run on `refs/heads/web` can restore only `web`'s own caches and the default branch's, never a tag's. So saving on the release tag didn't warm the next `web` build as the comment claimed. What it did warm — a re-run of the release's own build, or a `publish-web` dispatch on the same tag — doesn't earn a multi-GB entry per release against the repo's 10 GB cache budget. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-web.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/build-web.yaml b/.github/workflows/build-web.yaml index 44ae0f6d8370..9a2495b8263e 100644 --- a/.github/workflows/build-web.yaml +++ b/.github/workflows/build-web.yaml @@ -46,11 +46,9 @@ jobs: with: prefix-key: ${{ env.version }}-${{ hashFiles('./Cargo.lock') }} shared-key: web - # A release builds on its tag, and a later `web` build starts from - # that cache. save-if: ${{ github.ref == 'refs/heads/web' || github.ref == - 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }} + 'refs/heads/main' }} # Caching `~/.cargo/bin/` breaks the rustup `cargo`/`rustc` symlinks # on the new macos-15 runner image — see # https://github.com/Swatinem/rust-cache/issues/341.